Browsing Category: Vulnerabilities

Guest editorial by David Mortman[img_assist|nid=1786|title=|desc=|link=none|align=left|width=115|height=115]It’s early fall here in Ohio which means it’s time for the second round of canning for the winter. So last weekend my kitchen was covered in bushels of apples and pounds of greens and a whole lot of canning jars. As you know by now, I love to cook and I love a well-designed kitchen tool. Mason jars in particular make me extremely happy. They were invented in 1858 and fundamentally haven’t changed in the subsequent 150 years.

[img_assist|nid=1790|title=|desc=|link=none|align=right|width=115|height=115]They’re the Internet equivalent of storm chasers, spending endless hours scanning and sleuthing, looking for the telltale signs of botnets. Here’s an inside look at the battle against cybercrime’s weapons of mass infection. Read the full article. [CSOonline.com]

[img_assist|nid=1787|title=|desc=|link=none|align=left|width=115|height=115]A critical vulnerability in the Wikipedia Toolbar extension for Firefox has been discovered that can be exploited by an attacker to compromise a victim’s system. According to the Secunia report, the cause of the problem is due to the application using invalidated input in a call to eval() which can be exploited to execute arbitrary JavaScript code.

[img_assist|nid=1788|title=|desc=|link=none|align=right|width=115|height=115]Hackers are increasingly targeting law firms and public relations
companies with a sophisticated e-mail scheme that breaks into their
computer networks to steal sensitive data, often linked to large
corporate clients doing business overseas. Read the full article. [NYTimes.com/AP]

[img_assist|nid=1776|title=|desc=|link=none|align=left|width=115|height=115]The recent ACM Cloud Computing Security Workshop in Chicago was devoted specifically to cloud security. Speakers included Whitfield Diffie, a cryptographer and security
researcher who, in 1976, helped solve a fundamental problem of
cryptography: how to securely pass along the “keys” that unlock
encrypted material for intended recipients. Diffie, now a visiting professor at Royal Holloway, University of
London, was until recently a chief security officer at Sun
Microsystems. He sat down with Technology Review’s chief
correspondent. Read the full article. [Technology Review]

[img_assist|nid=1775|title=|desc=|link=none|align=right|width=175|height=88]A hacker has broken into the Nebraska Worker’s Compensation database,
prompting an FBI investigation and an effort to contact those who may
be affected. Several thousand people could be affected by the
breach, which was discovered last week when the state’s chief
information officer noticed an unusual amount of Internet traffic
traversing the Worker’s Compensation courts server. Read the full article. [KETV.com]

[img_assist|nid=1770|title=|desc=|link=none|align=left|width=115|height=115]U.K. police are hailing the sentencing of four people who used a
sophisticated Trojan horse program to siphon money out of online bank
accounts. The men used a Trojan horse program called PSP2-BBB that executed a
so-called man-in-the-browser attack when potential victims logged into
online bank accounts. The Trojan would insert a special page within the
customer’s browsing session asking for more personal information,
according to police. Read the full article. [IDG News]

[img_assist|nid=1771|title=|desc=|link=none|align=right|width=115|height=115]Internet security experts say that misconfigured DSL and cable
modems are worsening a well-known problem with the Internet’s DNS,
making it easier for hackers to launch DDoS attacks against their
victims. According to research, part of the problem is blamed on the growing number of
consumer devices on the Internet that are configured to accept DNS
queries from anywhere, what networking experts call an “open recursive”
or “open resolver” system. Read the full article. [InfoWorld]

[img_assist|nid=1765|title=|desc=|link=none|align=left|width=115|height=115]The same-origin policy vulnerability in Adobe Flash that was disclosed last week by a researcher at Foreground Security is more serious than just a simple software flaw, experts say. It illustrates a fundamental flaw in the way that Flash objects are handled by Web servers and Web browsers, alike, leading to a serious weakness on both ends of the Internet communication channel.

[img_assist|nid=1752|title=|desc=|link=none|align=right|width=115|height=115]Injection attacks top the 2010 OWASP Top 10 list of Web application security threats, including SQL, OS, and LDAP injection, followed by cross-site scripting (XSS), broken authentication and session management, insecure direct object references, cross-site request forgery (CSRF), security misconfiguration, failure to restrict URL access, unvalidated redirects and forwards, insecure cryptographic storage, and insufficient transport layer protection. The list is considered a “release candidate” that will be published in its final form in 2010. Read the full article. [Dark Reading]

A modern smartphone is a full-blown working tool, an entertainment center and a tool to manage your personal finances. The more it can do, the more attractive it is to cybercriminals. The evidence for...

Cybercriminals go at great lengths to throw researchers off their scent, but just like in the "offline" crime world they make errors and leave peculiar traces behind, making them look a bit silly, whi...

By Maria Karnaukh Genius is often simple. Those ideas that ultimately reap millions of dollars are usually found hiding in plain view – unnoticed until their time is right. Here are several examples o...